This Privacy Policy explains how Scanvato Labs LLC, a Texas limited liability company ("Scanvato Labs", "we", "us" or "our"), which operates Bay2Bill, collects, uses, shares and protects personal information when you visit bay2bill.com, contact us, or use the Bay2Bill application at app.bay2bill.com (together, the "Service").
1. Two roles we play
- Controller for account and website data. We decide how to use information about the shops that sign up, their Users, and people who visit our website or contact us. This policy covers that information.
- Processor for your customers' data. When a shop enters information about its own customers (for example, names, phone numbers, addresses, vehicles, estimates and invoices), the shop is the controller and we process that data only on the shop's instructions under our Data Processing Agreement. If you are a customer of a shop that uses Bay2Bill, please contact that shop about your data. We will help the shop respond.
2. Information we collect
Information you give us
- Account information: shop legal and display name, address, country, phone, business email, time zone; each User's name, email address and role; hashed passwords and two-factor authentication settings.
- Shop Data you enter: customers, vehicles (including VINs), estimates, work orders, invoices, payments you record, parts, technicians, logos and invoice terms. We process this for the shop as a processor (see Section 1).
- Support and sales inquiries: name, email, reason, subject and message you send through our contact form, plus later email replies.
Information collected automatically
- Sign-in and security data: IP address, browser/device (user-agent), approximate location derived from IP for "trusted device" records, sign-in times, and failed sign-in attempts. We use this to keep accounts secure.
- Activity records: records of key actions on documents (for example, an invoice being issued, printed, downloaded, emailed or voided) and which User performed them.
- Server logs: standard web server and application logs, which include IP address, request details and timestamps.
We do not use advertising trackers, sell data to data brokers, or build marketing profiles.
3. How we use information
| Purpose | Examples | Legal basis (EEA/UK) |
|---|---|---|
| Provide the Service | Create accounts, store and display Shop Data, produce PDFs, send documents the shop asks us to email | Contract |
| Security and fraud prevention | Sign-in protection, two-factor authentication, trusted devices, session management, investigating misuse | Legitimate interests; legal obligation |
| Support | Answer inquiries and emails | Contract; legitimate interests |
| Service communications | Important notices about your account, security, and changes to our terms | Contract; legal obligation |
| Improve the Service | Troubleshooting, aggregated usage analysis | Legitimate interests |
| Legal compliance | Tax, accounting, responding to lawful requests, enforcing our terms | Legal obligation; legitimate interests |
We will not send marketing emails without any consent the law requires, and you can opt out of marketing at any time.
4. How we share information
We do not sell or rent personal information, and we do not "share" it for cross-context behavioral advertising. We share information only:
- With service providers (sub-processors) that help us run the Service, under contracts that limit their use of the data:
| Provider | Purpose | Location |
|---|---|---|
| OVHcloud | Application hosting and database | See our DPA |
| Hostinger | Website hosting and our support mailbox | See our DPA |
| Resend | Delivery of estimate and invoice emails that shops send to their customers | United States |
| U.S. NHTSA vPIC | Decoding VINs entered by the shop (only the VIN is sent) | United States |
| ipwho.is | Approximate location of a sign-in IP address for trusted-device records | See provider |
| GitHub | Source code hosting and deployment (no Shop Data) | United States |
- At the shop's direction, for example when a shop emails an invoice to its customer.
- For legal reasons, if required by law, subpoena or court order, or to protect the rights, property or safety of us, our users or others.
- In a business transfer, such as a merger, acquisition or sale of assets, subject to this policy.
We keep the current list of sub-processors in our Data Processing Agreement and will update it before adding a new one.
5. Cookies and similar technologies
We use only strictly necessary cookies. They are required for signing in and security, so they are not used for tracking or advertising and do not require a consent banner.
| Cookie | Purpose | Lifetime |
|---|---|---|
ar_session |
Keeps you signed in | Up to your shop's session length |
ar_pending, ar_totp_pending, ar_pwchange_pending |
Carry you through multi-step sign-in (shop selection, two-factor, first-time password change) | 5 minutes |
ar_trusted_device |
Remembers a device you chose to trust so you are not asked for a two-factor code every time | Set by your shop's trusted-device setting |
| CSRF cookie | Protects forms against cross-site request forgery | Session |
The app also stores your display preferences (for example, content zoom level and list layout choices) in your browser's local storage. Our marketing website at bay2bill.com does not set cookies.
6. How long we keep information
- Shop Data: for as long as the shop's account is active, then deleted or returned as described in our Terms of Service and Data Processing Agreement, except where we must keep it by law.
- Account and security records: for the life of the account, and sign-in/session records for as long as needed for security and fraud prevention. We delete or anonymize them when they are no longer needed.
- Support inquiries: for as long as needed to follow up on the issue and keep a record of what we told you, then we delete or anonymize them.
- Legal and financial records: as long as tax, accounting or other laws require.
7. Security
We use industry-standard safeguards, including encryption in transit (HTTPS/TLS), strong password hashing, optional two-factor authentication, database-level isolation between shops, role-based access, and restricted administrative access. No system is perfectly secure; if we learn of a breach affecting your personal information, we will notify you and regulators as the law requires.
8. International transfers
We are based in the United States and our providers may process data in the United States and other countries. Where the law of your country (for example, the EEA, the United Kingdom or Switzerland) requires it, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy mechanism for transfers.
9. Your privacy rights
Depending on where you live, you may have the right to:
- access the personal information we hold about you and receive a copy (portability);
- correct inaccurate information;
- delete your information;
- object to or restrict certain processing;
- withdraw consent where we rely on consent;
- not be discriminated against for exercising your rights;
- complain to a data protection authority in your country.
California residents (CCPA/CPRA): in the past 12 months we collected identifiers, commercial information (Shop Data), internet or network activity, and approximate geolocation, for the business purposes in Section 3. We have not sold or shared personal information, and we do not use sensitive personal information to infer characteristics. You may use an authorized agent to make a request.
Other U.S. states (including Texas, Virginia, Colorado, Connecticut and others): you may have similar rights to access, correct, delete and obtain a copy of your data, and to appeal our decision. To appeal, reply to our decision email with "Appeal" in the subject line.
How to make a request: email support@bay2bill.com. We will verify your identity (usually by confirming control of your account email) and respond within the time the law requires (generally 30 to 45 days). If your request is about a shop's customer data, we will pass it to that shop and help it respond.
10. Children
The Service is for businesses and is not directed to children under 16. We do not knowingly collect their personal information.
11. Changes to this policy
We may update this policy. We will post the new version with a new version number and effective date and, for material changes, notify account owners by email before they take effect, as described in our Terms of Service.
12. Contact
Scanvato Labs LLC (operator of Bay2Bill)
3808 Smoke Tree Ln, McKinney, TX 75070
Email: support@bay2bill.com